Delivery

• Self-setup – Gain reputation – Set up DKIM, SPF, PTR record • Third Party – Instant reputation • Open Relay – Don’t leverage if on internet

Email With the payload packaged, it is time to deliver it and obtain initial access. Email delivery is a common method, whether sending a phishing email with a link or an attachment. Self-Setup: Set up your server to send the phishing email. There are many options for sending email such as Sendmail and Postfix. Every self-setup SMTP server should be configured with DKIM, SPF, and PTR records; this will assist in obtaining reputation. Plan around 30 days to gain reputation and be able to send email from your server to the target. Third Party: Using a third-party service (e.g., Gmail, Outlook/Live, Yahoo) increases reputation but may violate the Terms of Service. Third-party email services often implement controls to prevent spam on inbound and outbound email. Test sending the payload. Open Relay: Adversaries often use open mail relays but it is not advisable for adversary emulations from the internet. Once on the internal network, an open relay can be leveraged for phishing email to look very realistic. References: https://attack.mitre.org/techniques/T1566/ https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/ https://redcanary.com/blog/top-techniques-spearphishing-attachment-t1193/

Web

• Set up web server (domain, TLS, categorization) • Social engineer target to visit the red team web server, download, and execute payload • URL shortener at your own risk – A URL shortener may compensate for low reputation – Some services will detect the shortened URL and show a warning

Bypass URL Rewrite

Bypass URL Rewrite A great technique that security products will employ is rewriting of URLs in emails in order to create a buffer between the end user and the unknown contents behind that link. This rewritten URL is tracked by the security software and when a user engages with the link, it will test the contents stored at that URL. The security product will download any target files and pass to a scanning engine or detonation chamber to test for malicious content. Emails will also undergo content filtering looking for indicators that it may be a phishing email. Also, domains are checked against allow and block lists as well as 3rd party reputation lists. The bypass is simple, redirect the link scanners to a benign site and only delivery the malicious payload to the intended target. Many security products advertise their source ranges and rules can be established to redirect any requests from those source ranges. David E. Switzer (@violentlydave) wrote a tool called mkhtaccess_red that generates .htaccess files that redirect link scanners based off: • Sandbox/Security company networks by ASN • Current Tor exit nodes • Cloud provider networks (AWS, GCP, Azure, IBM, etc.) • User Agents of known security scanners/possible blue team tools • Networks seen in previous engagements References: https://rhinosecuritylabs.com/social-engineering/bypassing-email-security-url-scanning/ https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links?view=o365-worldwide https://oddvar.moe/2018/01/03/office-365-safe-links-bypass/ https://www.avanan.com/blog/basestriker-vulnerability-office-365 https://github.com/violentlydave/mkhtaccess_red/

Bypass Payload Scanning

• Payload scanning is effective against less sophisticated payloads • Advanced payloads will look for indicators of a sandbox and stop execution Checking/tracking the cursor position Waiting for user interaction such as mouse clicks Calling IsDebuggerPresent Checking SystemBiosVersion Network settings Checking for files or processes vmtoolsd.exe, vbox.exe, Wireshark.exe

Bypass Payload Scanning Sophisticated payloads should check the running environment for indicators of sandboxing or virtualization. Several techniques exist to ensure the payload only executes on the intended target and avoids malicious execution in a sandbox or detonation chamber. The payload may check any of the following to get a sense for the environment • Checking/tracking the cursor position to ensure there is user interaction • Waiting for user interaction such as mouse clicks before executing the malicious payload • Calling IsDebuggerPresent to detect an attached debugger • Checking SystemBiosVersion for known values that indicate a sandbox • Checking for files or processes that indicate a sandbox or tools used for analysis The SolarWinds software supply chain compromise in 2020 demonstrated a few sandbox bypass methods: • The malware waited 12-14 days until executed (waiting out a possible testing environment) • The malware also required the machine to be joined to a domain • Also, the malware would make DNS requests and halt execution if any of the responses were private network addresses Reference: https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/